design-review-garrytan
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands, including
grepand file existence checks ([ -e ... ]), to verify whether the full skill implementation is already present on the local system. - [EXTERNAL_DOWNLOADS]: The skill is designed to fetch its complete functionality from an external GitHub repository (
github.com/garrytan/gstack). This behavior involves downloading content from a third-party source that is not contained within the provided package. - [REMOTE_CODE_EXECUTION]: The skill uses the
npx skills addcommand to fetch, install, and potentially execute logic from a remote repository at runtime. This pattern bypasses static analysis of the actual implementation by bringing in external code during the installation phase.
Audit Metadata